The vulnerability resides in openssl_encrypt versions earlier than 1.4.0. The DangerousPatternVisitor AST analyzer fails to detect dunder attribute traversal, enabling attackers to construct chains such as __class__, __bases__, __subclasses__() and __globals__ that bypass sandbox restrictions and invoke system commands from plugin code. This flaw is classified as CWE-693 and carries a CVSS score of 9.3, indicating a severe risk level for confidentiality, integrity, and availability.

The affected product is the openssl_encrypt library developed by jahlives. Only releases before 1.4.0 contain the insecure sandbox logic; all subsequent releases are presumed fixed.

The absence of an EPSS score and the lack of listing in the CISA KEV catalog do not reflect the inherent danger of this flaw; the high CVSS score signals significant remote exploitation potential. Attackers can trigger the vulnerability by injecting malicious plugin code that performs dunder attribute traversal, thereby escaping the sandbox environment and executing arbitrary commands on the host. While no public exploitation evidence is present, the path to exploitation is straightforward for threat actors capable of modifying or supplying plugin modules.